Find Core and the process generated it

[Global Service Desk]

HI Friends,

i coudnt find any pointer to the following problem which i have been working for some time.

1. Find the core files in system and move it central location,
2. How to find what process generated this core file.

Its been asked by our team members, but i am running out of things. if anybody has any script please help me out.

THanks In advance

BestRegards,
Govind,

[Muthukumar_5 · Accepted solution]

1. Find the core files in system and move it central location,

# find / -name "core" -exec mv {} \;

2. How to find what process generated this core file.

# file core
# what core

--
Muthu

[Arunvijai_4]

Hi Govind,

You can find the core files by,

# find / -type f -name "core" and to see which process caused the core by,

# file `find / -type f -name "core"`

You can move all core to any central location if needed, I dont think you have "coreadm" as of solaris.

-Arun

[Arunvijai_4]

Hi Govind,

A similar thread should help you,

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=898593

-Arun

[Sivakumar TS]

Hi,

#file `find / -type f -name core*`

Should satisfy your requirement.

The above command will search for all core files in the system and give the brief description about its origin.

Regards,

Siva.

[Global Service Desk]

Thanks for the replies,

but how do i move all the core files to one location. for that i need to change the name of the core files right otherwise it will overwrite the existing.

can anyone tell me how do i do that.

i will assign points ...

thanks in advance
GOvinda.

[Muthukumar_5]

I hope core files are keep on updated based on application. Few applications are creating new core files if some file is named with core available.

If you want to move core files to centralized directory then,

a) You can find all files named with core and move them to that directory

b) Configure application core making location to your centralized place.

I hope first one is very possible as,

# find / -name "core" -exec mv {} \;

--
Muthu

[Arunvijai_4]

Hi Govind,

but how do i move all the core files to one location. for that i need to change the name of the core files right otherwise it will overwrite the existing.

You can do it, try to use file command which gives which process causes the core, then use that process name as prefix or suffix of the core, then move it to your preferred location.

Its simple and ease of use, may be compared to "creadm" command in solaris. Take a look at the thread which i posted in my previous reply.

-Arun

[Senthil Kumar .A_1]

Hi Govind,

1) U can use the find command given by Muthukumar to segregate the core files.

2) Make sure you switch on the core file naming convention so as to, it includes the PID in its name, while ists saved. you can do this by doing the following in 11.x and up machines..

echo "core_addpid/W 1\ncore_addpid?W 1" | adb -w -k /stand/vmunix /dev/mem

Note: if u rebuild ur kernel in future, remember to rerun these commands once again.

3) Enable process auditing in you system. To do it. .. refer the "man" page of AUDIT.

man 4 audit
man 5 audit

Final Result:

From the step 2, whenever a core file gets created , u can get 2 infos by Performing "ll" on the core file

a) PID
b) Time of core file creation

From step 3, u will be able to get
a)time of the process execution
b)PID

NOW by mapping the PID from above info's aligned with particular time, you will be able to find, which process Cored while execution.

NOTE: There are programs to analyze core files, like q4 etc...That may be able to get the info's u require without performing the above steps. but I haven't used q4 personally.

Anyway,

Regards,
Senthil Kumar .A

[Global Service Desk]

THanks for all,

I will try all these things and let you know !

THanks
Govinda.

[Arunvijai_4]

Hi Govind,

This thread should be useful as well,
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=665680

-Arun